Research shows a .NET proxy design flaw enables file writes and RCE through attacker-supplied WSDL in multiple products.
Microsoft seems to have heard the criticism against AI Actions in File Explorer and will let users turn them off if desired.